Data preservation method for server and application system

Abstract

The invention relates to the technical field of data maintenance, in particular to a data preservation method for a server and an application system. The method comprises the following steps: acquiring an emergency backup request, analyzing the emergency backup request, and determining a trigger time point; according to the triggering time point, historical backup data are called, and current newly-added data are determined according to the historical backup data; analyzing the current newly-added data to obtain data features; according to the data features, performing multi-dimensional disassembly on the current newly-added data to obtain fragment data; and obtaining network topology information at the current moment, and according to the network topology information and the data characteristics, determining a differentiated backup scheme of the fragment data to perform data preservation operation. The probability that the infected data enter the backup link is reduced, and the recognition accuracy of the high-sensitivity data is improved. According to the method, the network topology information at the current moment is obtained, and the differentiated backup scheme of the fragment data is determined according to the network topology information and the data characteristics to perform data preservation operation, so that the utilization rate of network resources is improved.

Description

Technical Field

[0001] This application relates to the technical field of data maintenance, and in particular, to a data preservation method and application system for servers. Background Art

[0002] In the operation and maintenance management of data centers, server data preservation technology is the core guarantee means to cope with emergencies such as natural disasters and cyber attacks. Traditional technologies generally adopt a "two places and three centers" architecture to achieve off-site backup, relying on a combination of regular full backups and incremental backups.

[0003] However, in the face of complex disaster scenarios or advanced persistent threat attacks, traditional backup systems cannot achieve comprehensive preservation, resulting in low preservation efficiency, which has become a significant defect of the existing technology. Summary of the Invention

[0004] This application provides a data preservation method and application system for servers to solve the above problems.

[0005] In a first aspect, this application provides a data preservation method for servers, and the method includes: Obtain an emergency backup request, parse the emergency backup request, and determine the trigger time point; According to the trigger time point, retrieve historical backup data, and according to the historical backup data, determine the currently newly added data; Parse the currently newly added data to obtain data characteristics; according to the data characteristics, perform multi-dimensional decomposition on the currently newly added data to obtain segment data; Obtain the network topology information at the current moment, and according to the network topology information and the data characteristics, determine a differential backup scheme for the segment data to perform data preservation operations.

[0006] Through this solution, obtain an emergency backup request, parse the emergency backup request, and determine the trigger time point to avoid the trigger logic confusion caused by a single clock deviation. According to the trigger time point, retrieve historical backup data, and according to the historical backup data, determine the currently newly added data to avoid bandwidth waste caused by full backups and eliminate the data overwrite risk caused by version dislocation. Parse the currently newly added data to obtain data characteristics, which helps to reduce the amount of index data transmitted repeatedly in a single incremental backup and improve the recovery success rate of log files. According to the data characteristics, perform multi-dimensional decomposition on the currently newly added data to obtain segment data, reduce the probability of infected data entering the backup link, and improve the recognition accuracy of highly sensitive data. Obtain the network topology information at the current moment, and according to the network topology information and the data characteristics, determine a differential backup scheme for the segment data to perform data preservation operations, which helps to improve the utilization rate of network resources.

[0007] Optionally, parsing the currently newly added data to obtain data features includes: using a binary mode to extract the file header bytes of the currently newly added data to determine the file type; matching the extracted bytes with a predefined signature database, and determining a file format signature according to the matching result; obtaining the data storage path of the currently newly added data, and determining a data extension according to the data storage path; calculating the occurrence frequency of bytes in each currently newly added data; determining a content entropy value according to the occurrence frequency; obtaining a database transaction log; determining the access frequency of the currently newly added data according to the database transaction log; and determining the file type, the file format signature, the data extension, the content entropy value, and the access frequency as the data features of the currently newly added data.

[0008] Optionally, performing multi-dimensional decomposition on the currently newly added data according to the data features to obtain segment data includes: determining structured data, unstructured data, and time-series data according to the data features; analyzing the structured data, the unstructured data, and the time-series data to determine corresponding chunking algorithms; analyzing the database transaction log to determine the log writing frequency and the written data; determining a decomposition granularity according to the log writing frequency and the written data; and performing multi-dimensional decomposition on the currently newly added data according to the chunking algorithms and the decomposition granularity to obtain segment data.

[0009] Optionally, determining the decomposition granularity according to the log writing frequency and the written data includes: parsing the written data to determine the written data block size and the written data type; determining high-frequency written data and low-frequency written data according to the written data type; determining the high-frequency update frequency of the high-frequency written data and the low-frequency update frequency of the low-frequency written data according to the log writing frequency; and determining the decomposition granularity according to the written data block size, the high-frequency update frequency, and the low-frequency update frequency.

[0010] Optionally, determining a differential backup scheme for the segment data according to the network topology information and the data features includes: analyzing the network topology information to determine the real-time delay, the packet loss rate, and the remaining bandwidth; analyzing the currently newly added data to determine the data sensitivity; determining a bandwidth preemption priority according to the data sensitivity and the data features; determining an optimal transmission protocol according to the bandwidth preemption priority, the data sensitivity, and the real-time delay; and determining a differential backup scheme for the segment data according to the bandwidth preemption priority and the optimal transmission protocol.

[0011] Optionally, after parsing the emergency backup request and determining the trigger time point, the method further includes: parsing the emergency backup request to determine the data to be backed up; scanning the process call chain of the data to be backed up to identify abnormal dynamic link libraries; extracting the abnormal dynamic link libraries to determine the isolated data blocks and the API call sequence of each isolated data block; based on the API call sequence, matching each isolated data block with a known virus behavior feature library; according to the matching result, determining the abnormal data blocks with abnormal features; transferring the abnormal data blocks to an isolated storage pool for virus feature comparison, and according to the virus comparison result, determining whether the abnormal data blocks carry viruses.

[0012] Optionally, the determining the differential backup scheme for the fragmented data according to the network topology information and the data characteristics includes: if the abnormal data block carries a virus, performing a time rollback on the abnormal data block to determine the data before infection; according to the virus comparison result, determining the infection degree of the abnormal data block; according to the infection degree, determining the data sensitivity level of each abnormal data block; according to the data sensitivity level, the network topology information and the data characteristics, determining the differential backup scheme for the fragmented data.

[0013] Optionally, the obtaining the emergency backup request, parsing the emergency backup request, and determining the trigger time point includes: obtaining environmental monitoring data and intrusion monitoring data in real time; analyzing the environmental monitoring data and the intrusion monitoring data to determine environmental changes and port access conditions; analyzing the port access conditions to determine whether there is abnormal access; if it is determined that there is abnormal access, determining the number of abnormal accesses according to the port access conditions; comparing the number of abnormal accesses with an abnormal access frequency threshold; analyzing the environmental changes to determine whether any two environmental parameters exceed the corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values, generating an emergency backup request; determining the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values as the trigger time point.

[0014] Optionally, the analyzing the currently newly added data and determining the data sensitivity includes: determining the metadata attributes of the currently newly added data according to the data characteristics; obtaining historical operation data, extracting the historical operation data, and determining the identity identifier of the data creator, the data access control list, and the data encryption status; according to the identity identifier of the data creator, querying a preset organizational structure database to determine the security level of the business department to which the data belongs; analyzing the data access control list to identify the authorized user roles and the scope of permission operations; calculating the data sensitivity through a weighted decision tree model according to the security level, the scope of permission operations, and the encryption status.

[0015] In a second aspect, the present application provides a data preservation application system for a server, and the system includes: A request parsing module, configured to obtain an emergency backup request, parse the emergency backup request, and determine a trigger time point; A data determination module, configured to retrieve historical backup data according to the trigger time point, and determine current newly added data according to the historical backup data; A data disassembling module, configured to parse the current newly added data to obtain data features; according to the data features, perform multi-dimensional disassembling on the current newly added data to obtain segment data; A solution determination module, configured to obtain network topology information at the current moment, and determine a differential backup solution for the segment data according to the network topology information and the data features to perform data preservation operations.

[0016] Optionally, when the data disassembling module parses the current newly added data to obtain data features, it is configured to: use a binary mode to extract the file header bytes of the current newly added data to determine the file type; match the extracted bytes with a predefined signature database, and determine a file format signature according to the matching result; obtain the data storage path of the current newly added data, and determine a data extension according to the data storage path; calculate the occurrence frequency of bytes in each current newly added data; determine a content entropy value according to the occurrence frequency; obtain a database transaction log; determine the access frequency of the current newly added data according to the database transaction log; and determine the file type, the file format signature, the data extension, the content entropy value, and the access frequency as the data features of the current newly added data.

[0017] Optionally, when the data disassembling module performs multi-dimensional disassembling on the current newly added data according to data features to obtain segment data, it is configured to: determine structured data, unstructured data, and time-series data according to the data features; analyze the structured data, the unstructured data, and the time-series data to determine corresponding chunking algorithms; analyze the database transaction log to determine a log writing frequency and written data; determine a disassembly granularity according to the log writing frequency and the written data; and perform multi-dimensional disassembling on the current newly added data according to the chunking algorithm and the disassembly granularity to obtain segment data.

[0018] Optionally, when determining the disassembly granularity according to the log writing frequency and the written data, the data disassembly module is used to: parse the written data to determine the size of the written data block and the type of the written data; determine the frequently written data and the infrequently written data according to the type of the written data; determine the high-frequency update frequency of the frequently written data and the low-frequency update frequency of the infrequently written data according to the log writing frequency; and determine the disassembly granularity according to the size of the written data block, the high-frequency update frequency, and the low-frequency update frequency.

[0019] Optionally, when determining the differential backup solution for the fragment data according to the network topology information and the data characteristics, the solution determination module is used to: analyze the network topology information to determine the real-time delay, the packet loss rate, and the remaining bandwidth; analyze the currently newly added data to determine the data sensitivity; determine the bandwidth preemption priority according to the data sensitivity and the data characteristics; determine the optimal transmission protocol according to the bandwidth preemption priority, the data sensitivity, and the real-time delay; and determine the differential backup solution for the fragment data according to the bandwidth preemption priority and the optimal transmission protocol.

[0020] Optionally, the server data preservation application system further includes a virus determination module, which is used to: parse the emergency backup request to determine the data to be backed up; scan the process call chain of the data to be backed up to identify abnormal dynamic link libraries; extract the abnormal dynamic link libraries to determine the isolated data blocks and the API call sequence of each isolated data block; based on the API call sequence, match each isolated data block with a known virus behavior feature library; determine the abnormal data blocks with abnormal features according to the matching result; transfer the abnormal data blocks to an isolated storage pool for virus feature comparison, and determine whether the abnormal data blocks carry viruses according to the virus comparison result.

[0021] Optionally, when determining the differential backup solution for the fragment data according to the network topology information and the data characteristics, the solution determination module is used to: if the abnormal data block carries a virus, perform a time rollback on the abnormal data block to determine the data before infection; determine the infection degree of the abnormal data block according to the virus comparison result; determine the data sensitivity level of each abnormal data block according to the infection degree; and determine the differential backup solution for the fragment data according to the data sensitivity level, the network topology information, and the data characteristics.

[0022] Optionally, when the request parsing module obtains an emergency backup request, parses the emergency backup request, and determines the trigger time point, it is used for: obtaining environmental monitoring data and intrusion monitoring data in real time; analyzing the environmental monitoring data and the intrusion monitoring data to determine environmental changes and port access conditions; analyzing the port access conditions to determine whether there is abnormal access; if it is determined that there is abnormal access, determining the number of abnormal accesses according to the port access conditions; comparing the number of abnormal accesses with the abnormal access frequency threshold; analyzing the environmental changes to determine whether any two environmental parameters exceed the corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values, generating an emergency backup request; and determining the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values as the trigger time point.

[0023] Optionally, when the solution determination module analyzes the currently newly added data and determines the data sensitivity, it is used for: determining the metadata attributes of the currently newly added data according to the data characteristics; obtaining historical operation data, extracting the historical operation data, and determining the identity identifier of the data creator, the data access control list, and the data encryption status; querying a preset organizational structure database according to the identity identifier of the data creator to determine the security level of the business department to which the data belongs; analyzing the data access control list to identify the authorized user roles and permission operation scopes; and calculating the data sensitivity through a weighted decision tree model according to the security level, the permission operation scope, and the encryption status. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained according to these drawings without creative efforts.

[0025] Figure 1 It is a schematic diagram of an application scenario provided by an embodiment of the present application; Figure 2 It is a flowchart of a data preservation method for a server provided by an embodiment of the present application; Figure 3 It is a schematic structural diagram of a data preservation application system for a server provided by an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0026] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are some, but not all, of the embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of this application without creative efforts fall within the scope of protection of this application.

[0027] In addition, the term "and / or" in this document is merely a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally represents an "or" relationship between the associated objects before and after, unless otherwise specified.

[0028] The following further describes the embodiments of this application in detail with reference to the accompanying drawings of the specification.

[0029] In data center operation and maintenance, server data preservation is the last line of defense against emergencies such as natural disasters and cyberattacks. Traditional methods generally adopt a "two-location three-center" architecture for off-site backup, relying on the combination of periodic full backups and incremental backups. However, in the face of complex disaster scenarios (such as sudden changes in the computer room environment) or advanced persistent threat (APT) attacks, the existing technologies have the following significant defects: Most existing backup systems trigger emergency processes based on a single metric threshold (such as environmental sensor overrun or the number of port scans), lacking the correlation analysis of multi-source heterogeneous data. Especially in the scenario of network intrusion, malicious programs often lurk in normal data streams. If only relying on static thresholds to trigger backups, the infected data may be synchronized to off-site nodes, resulting in the spread of viruses.

[0030] Existing differential backup solutions usually rely on preset priorities or fixed rules. When the bandwidth is tight, highly sensitive data may not be able to preempt resources due to the use of an inefficient transmission protocol (such as FTP), while low-value data (such as temporary caches) occupies high-quality links, resulting in a reduction in the timeliness of critical data backup.

[0031] Traditional methods usually perform virus scans after backups are completed. However, if the backup data already carries new malicious code, the off-site storage node may become a secondary infection source.

[0032] Based on this, the present application provides a data preservation method and application system for a server, which obtains an emergency backup request, parses the emergency backup request, determines the trigger time point, and avoids the trigger logic confusion caused by a single clock deviation. According to the trigger time point, historical backup data is retrieved, and based on the historical backup data, the currently newly added data is determined, avoiding the bandwidth waste caused by full backup and eliminating the data overwrite risk caused by version misalignment. Parsing the currently newly added data to obtain data characteristics helps to reduce the amount of index data transmitted repeatedly in a single incremental backup and improve the recovery success rate of log files. According to the data characteristics, the currently newly added data is disassembled in multiple dimensions to obtain fragment data, reducing the probability of infected data entering the backup link and improving the recognition accuracy of highly sensitive data. Obtaining the network topology information at the current moment, and according to the network topology information and data characteristics, determining a differential backup scheme for the fragment data to perform data preservation operations, which helps to improve the utilization rate of network resources.

[0033] Figure 1 FIG. is a schematic diagram of an application scenario provided by the present application. When performing data preservation of a server, the method provided by the present application is applied.

[0034] Specifically, the method provided by the present application is applied to any server. The server interacts with the built-in intrusion detection system, obtains an emergency backup request through the built-in detection device, parses the emergency backup request, determines the trigger time point, and avoids the trigger logic confusion caused by a single clock deviation. According to the trigger time point, historical backup data is retrieved, and based on the historical backup data, the currently newly added data is determined, avoiding the bandwidth waste caused by full backup and eliminating the data overwrite risk caused by version misalignment. Parsing the currently newly added data to obtain data characteristics helps to reduce the amount of index data transmitted repeatedly in a single incremental backup and improve the recovery success rate of log files. According to the data characteristics, the currently newly added data is disassembled in multiple dimensions to obtain fragment data, reducing the probability of infected data entering the backup link and improving the recognition accuracy of highly sensitive data. Obtaining the network topology information at the current moment, and according to the network topology information and data characteristics, determining a differential backup scheme for the fragment data to perform data preservation operations, which helps to improve the utilization rate of network resources. The specific implementation manner can refer to the following embodiments.

[0035] Figure 2 FIG. is a flowchart of a data preservation method for a server provided by an embodiment of the present application. The method of this embodiment can be applied to the server in the above scenario. As Figure 2 shown, the method includes: S201. Obtain an emergency backup request, parse the emergency backup request, and determine the trigger time point; The emergency backup request can be a composite exception trigger instruction.

[0036] The trigger time point can be the moment when the first event that meets the composite exception condition occurs in a multi-source event.

[0037] Specifically, obtain an emergency backup request, extract the trigger event type, exception time window, and affected data range identifier from the emergency backup request; finally, after synchronizing the clocks of the primary and standby nodes using the NTP protocol, calculate the trigger time point based on the earliest data source trigger moment within the exception time window.

[0038] In a specific implementation manner, the intrusion detection system obtains real-time data streams and defines a data source type set; then, according to the association strength of various data sources in the historical exception event library, initial weights are assigned through the inherent reliability of the data sources. When a certain type of data source continuously triggers exceptions but does not form an effective threat, its weight is reduced through a negative feedback mechanism, thereby generating a dynamic weight coefficient; furthermore, the heterogeneous data streams are standardized to determine the combined weight of multi-source data. When the combined weight of multi-source data exceeds the dynamic threshold constructed based on historical normal state data, an emergency backup request is generated.

[0039] S202. According to the trigger time point, retrieve historical backup data, and determine the currently newly added data based on the historical backup data. The historical backup data can be the metadata index of the most recent full backup.

[0040] The currently newly added data can be a set of data that has been generated or modified since the last backup.

[0041] Specifically, according to the metadata index of the most recent full backup before the trigger time point, that is, the historical backup data, pull the directory tree structure of the corresponding version snapshot from the off-site storage node; then, adopt a two-layer comparison mechanism to determine the currently newly added data: first, quickly screen out the modified files through hash value comparison; then, according to the preset dynamic chunking rule, use Rabin fingerprints as the sliding window hash function, dynamically re-chunk the modified files according to the data locality characteristics, calculate the hash for each chunk and compare it with the historical chunk records, and screen out the chunks with inconsistent hash values and mark them as the currently newly added data.

[0042] S203. Analyze the currently newly added data to obtain data characteristics; according to the data characteristics, perform multi-dimensional decomposition on the currently newly added data to obtain segment data. The data characteristics can be a set of tags including data type, update frequency, and security attributes.

[0043] The segment data can be the smallest logical unit.

[0044] Specifically, perform metadata analysis on the currently newly added data to extract data characteristics such as data type, compression ratio, and entropy value.

[0045] According to the data characteristics, the newly added data is disassembled in multiple dimensions: First, for the frequently updated fields, fine-grained blocks are adopted, and the low-frequency fields are merged into coarse-grained blocks; Second, the unstructured files are split according to semantic units; Then, for the data blocks determined to be high-risk in the sandbox detection, isolation marks are inserted and alternative placeholders are generated; Finally, the fragmented data with metadata tags is obtained.

[0046] S204. Obtain the network topology information at the current moment, and determine the differential backup scheme for the fragmented data according to the network topology information and data characteristics to perform data preservation operations.

[0047] The network topology information can be a set of transmission path quality indicators.

[0048] The differential backup scheme can be a combination of transmission strategies generated according to the sensitivity of the fragmented data and the network topology state.

[0049] Specifically, the software-defined network controller is used to obtain the real-time state of the entire network and construct the network topology information; Subsequently, the fragmented data is graded according to sensitivity; Then, the highly sensitive data is allocated to the low-latency path and encrypted and transmitted using AES-256-GCM; The low-sensitive data uses the UDP acceleration channel and enables forward error correction coding; Furthermore, for the fragmented data with abnormal sandbox detection, the "fuse" mechanism is used to temporarily store it in the encrypted buffer area, and breakpoint resumption is performed after manual confirmation; Thus, a differential backup scheme is generated; Finally, version rollback is performed, and the corresponding block is extracted from the historical clean backup for replacement and then transmitted.

[0050] Through this solution, an emergency backup request is obtained, the emergency backup request is parsed, the trigger time point is determined, and the trigger logic chaos caused by a single clock deviation is avoided. According to the trigger time point, the historical backup data is retrieved, and according to the historical backup data, the newly added data is determined, avoiding the bandwidth waste caused by full backup and eliminating the data coverage risk caused by version misalignment. The newly added data is parsed to obtain data characteristics, which helps to reduce the amount of index data transmitted repeatedly in a single incremental backup and improve the recovery success rate of log files. According to the data characteristics, the newly added data is disassembled in multiple dimensions to obtain fragmented data, reducing the probability of infected data entering the backup link and improving the recognition accuracy of highly sensitive data. Obtain the network topology information at the current moment, and determine the differential backup scheme for the fragmented data according to the network topology information and data characteristics to perform data preservation operations, which helps to improve the utilization rate of network resources.

[0051] In some embodiments, in binary mode, extract the header bytes of the current newly added data to determine the file type; match the extracted bytes with a predefined signature database, and determine the file format signature according to the matching result; obtain the data storage path of the current newly added data, and determine the data extension according to the data storage path; calculate the occurrence frequency of each byte in the current newly added data; determine the content entropy value according to the occurrence frequency; obtain the database transaction log; determine the access frequency of the current newly added data according to the database transaction log; determine the file type, file format signature, data extension, content entropy value, and access frequency as the data features of the current newly added data.

[0052] The binary mode can be directly reading the original binary data stream of the file.

[0053] The file type can be the actual format category of the data.

[0054] The extracted bytes can be binary data sequences of different lengths intercepted from the file header.

[0055] The signature database can be a predefined comparison database containing virus signature codes and legal application whitelist signatures.

[0056] The matching result can be a status label output after comparing the extracted bytes with the signature database.

[0057] The file format signature can be an identifier for the legality of the file format.

[0058] The data storage path can be the complete path of the current newly added data in the storage device.

[0059] The data extension can be a file extension name string.

[0060] A byte can be the smallest processing unit of the file content.

[0061] The occurrence frequency can be the number of times each byte value appears in the current newly added data.

[0062] The content entropy value can be an information entropy value calculated based on the byte occurrence frequency.

[0063] The database transaction log can be a log file recording database operations.

[0064] The access frequency can be the number of times the current newly added data is accessed per unit time.

[0065] Specifically, read the first N bytes of the currently newly added data in binary mode to extract the file header byte sequence; then, construct a format feature library based on the magic number characteristics of the file header byte sequence, match the predefined format rule library, and output the file type label if the match is successful. Compare each byte of the extracted bytes with the predefined signature database one by one. If the bytes are continuously matched, output the file format signature. Subsequently, parse the data storage path of the currently newly added data in the storage device, intercept the file name suffix, and generate the data extension. Traverse all the byte streams of the currently newly added data, and count the occurrence frequency of each byte value. Furthermore, calculate the content entropy value according to the occurrence frequency using the Shannon entropy formula. Through the log query interface managed by the database, retrieve the database transaction log related to the currently newly added data according to the data identification field. Then, retrieve the operation record corresponding to the currently newly added data from the database transaction log, count the access times within a unit time, and generate the access frequency. Integrate the file type, file format signature, data extension, content entropy value, and access frequency into the JSON format, and perform normalization processing on the JSON format to eliminate the dimension difference, forming the data characteristics of the currently newly added data.

[0066] Through this solution, using the binary mode to extract the file header bytes of the currently newly added data to determine the file type helps to avoid misclassification caused by file extension tampering and eliminate the file disguise problem in the scenario of virus intrusion and backup process conflict. Match the extracted bytes with the predefined signature database, and determine the file format signature according to the matching result to achieve preliminary virus interception before backup and reduce the risk of unisolated infected data blocks. Obtain the data storage path of the currently newly added data, and determine the data extension according to the data storage path to alleviate the classification error caused by the static nature of sensitivity assessment. Calculate the occurrence frequency of bytes in each currently newly added data, which helps to quantify the distribution characteristics of the data content. Determine the content entropy value according to the occurrence frequency, dynamically enhance the objectivity of sensitivity assessment, and eliminate the defect of sensitivity grading relying on manual annotation. Obtain the database transaction log, which helps to support the differential chunking strategy required for intelligent data disassembly. Determine the access frequency of the currently newly added data according to the database transaction log, which helps to eliminate the problem of static network resource allocation. Determine the file type, file format signature, data extension, content entropy value, and access frequency as the data characteristics of the currently newly added data to achieve the coordinated operation of embedded virus defense and multi-dimensional sensitivity assessment.

[0067] In some embodiments, determine structured data, unstructured data, and time-series data according to the data characteristics; analyze the structured data, unstructured data, and time-series data to determine the corresponding chunking algorithms; analyze the database transaction log to determine the log writing frequency and the written data; determine the disassembly granularity according to the log writing frequency and the written data; perform multi-dimensional disassembly on the currently newly added data according to the chunking algorithms and the disassembly granularity to obtain fragmented data.

[0068] Structured data can be a collection of data with a predefined data model and a fixed format.

[0069] Unstructured data can be a collection of data without a unified data model or a fixed format.

[0070] Time-series data can be a data stream generated and stored in chronological order.

[0071] The chunking algorithm can be a set of rules that cuts a continuous data stream or file into independent processing units according to the characteristics of the data type.

[0072] The log write frequency can be the number of write operation triggers recorded in the database transaction log per unit time.

[0073] The written data can be the amount of data involved in a single database transaction operation.

[0074] The disassembly granularity can be a scale control parameter for individual segment data during data chunking processing.

[0075] Specifically, based on data characteristics, first, when the file type is a database table file or the data extension matches the structured data identifier, it is determined as structured data; second, when the file type is an image / document or the content entropy value indicates a non-random distribution, it is determined as unstructured data; then, when the file format signature matches the time-series data identifier and the access frequency is too high, it is determined as time-series data. According to the structured data, unstructured data, and time-series data, the corresponding chunking algorithms are determined: first, parse the operation range corresponding to the transaction ID in the database transaction log, and divide the data into chunks according to the transaction commit boundary, that is, use the transaction boundary chunking algorithm for structured data; second, dynamically adjust the window size based on the content entropy value, calculate the hash value by sliding with a fixed step size, and trigger the chunking boundary, that is, use the sliding window chunking algorithm for unstructured data; then, set the time window length according to the log write frequency, and align the data stream according to the timestamp, that is, use the time window chunking algorithm for time-series data. Extract the log write frequency and the written data associated with the current newly added data from the database transaction log. Furthermore, parse the log write frequency and the written data in the database transaction log, calculate the data update amount per unit time. If the log write frequency is high and the amount of data written per single write is low, it is determined as a high-frequency low-load scenario and fine-grained decomposition is adopted; if the log write frequency is low and the amount of data written per single write is high, it is determined as a low-frequency high-load scenario and coarse-grained decomposition is adopted. According to the chunking algorithm and the decomposition granularity, perform multi-dimensional decomposition on the current newly added data. First, divide the structured data according to the transaction boundary chunking algorithm to ensure that each chunk contains a complete transaction boundary and the chunk size is restricted by the decomposition granularity; second, for the unstructured data generated by the sliding window chunking algorithm, when the content entropy value is too high, reduce the window step size to reduce the entropy value fluctuation within the chunk; then, slice the time-series data according to the time window chunking algorithm. If the access frequency difference between adjacent log records is too large, dynamically expand the time window to include the complete transaction chain; finally, attach metadata tags to each data chunk to generate fragmented data.

[0076] Through this solution, structured data, unstructured data, and time-series data are determined according to data characteristics, which helps to eliminate the problem of a single chunking strategy caused by the failure to combine data type differences. At the same time, it avoids chunking failure caused by misjudgment of data attributes. Analyze structured data, unstructured data, and time-series data to determine the corresponding chunking algorithms, avoid repeated transmission of unchanged data during incremental backup, reduce bandwidth waste, prevent the slicing of semantically coherent content due to fixed chunking, reduce the risk of recovery failure, and at the same time avoid transmission delays caused by overly large chunks for high-frequency data or increased redundancy due to overly fine chunks for low-frequency data. Analyze the database transaction log to determine the log write frequency and the written data, which helps to quantify the characteristics of dynamic data updates and eliminate the problem of unreasonable disassembly granularity caused by ignoring transaction operation rules. Determining the disassembly granularity according to the log write frequency and the written data helps to prevent data chaos in incremental backup caused by cross-transaction chunking, enhance the accuracy of virus scanning and isolation, and balance the chunking timeliness and transmission efficiency. Multidimensionally disassemble the currently newly added data according to the chunking algorithm and the disassembly granularity to obtain fragment data, which helps to eliminate the problem of disconnection between the chunking result and the transmission or detection link.

[0077] In some embodiments, parse the written data to determine the size of the written data block and the type of the written data; according to the type of the written data, determine the high-frequency written data and the low-frequency written data; according to the log write frequency, determine the high-frequency update frequency of the high-frequency written data and the low-frequency update frequency of the low-frequency written data; determine the disassembly granularity according to the size of the written data block, the high-frequency update frequency, and the low-frequency update frequency.

[0078] The size of the written data block can be the amount of data involved in a single write operation.

[0079] The type of the written data can be the format category of the written data.

[0080] The high-frequency written data can be the data type that needs to be updated frequently.

[0081] The low-frequency written data can be the data type with a long update interval.

[0082] The high-frequency update frequency can be the average number of write operations of the high-frequency written data per unit time.

[0083] The low-frequency update frequency can be the average write operation interval of the low-frequency written data per unit time.

[0084] Specifically, according to the written data, extract the original data content of a single database transaction operation, parse the byte stream length, and determine the size of the written data block; at the same time, based on the file format signature, identify the type of the written data. Associate the preset update feature rule library according to the type of the written data to determine the frequently written data and the infrequently written data: First, if it is a table frequently operated in the database transaction log, it is marked as frequently written data; Second, if it is a periodically generated log file or image backup, it is marked as infrequently written data. Based on the log writing frequency, count the number of operations triggered by the frequently written data in the database transaction log within a unit time, and calculate the high-frequency update frequency; then, count the operation interval of the infrequently written data in the database transaction log within a unit time, and calculate the low-frequency update frequency. Set the upper limit of the block size inversely according to the high-frequency update frequency value, and then set the lower limit of the block size according to the product of the written data block size and the low-frequency update frequency value. Finally, take the intersection value of the high-frequency block upper limit and the low-frequency block lower limit as the disassembly granularity.

[0085] Through this solution, parse the written data, determine the size of the written data block and the type of the written data, and avoid disassembly failure caused by misjudgment of data scale and format. According to the type of the written data, determine the frequently written data and the infrequently written data, and prevent the low-frequency data from occupying the high-frequency channel bandwidth. According to the log writing frequency, determine the high-frequency update frequency of the frequently written data and the low-frequency update frequency of the infrequently written data, dynamically quantify the data update intensity, and provide a calculation basis for the block granularity. According to the written data block size, high-frequency update frequency and low-frequency update frequency, determine the disassembly granularity, which helps to reduce the amount of duplicate data during incremental backup and avoid the complexity of the recovery logic caused by excessive splitting.

[0086] In some embodiments, analyze the network topology information to determine the real-time delay, packet loss rate and remaining bandwidth; analyze the currently newly added data to determine the data sensitivity; determine the bandwidth preemption priority according to the data sensitivity and data characteristics; determine the best transmission protocol according to the bandwidth preemption priority, data sensitivity and real-time delay; determine the differential backup scheme for the fragmented data according to the bandwidth preemption priority and the best transmission protocol.

[0087] The real-time delay can be the end-to-end transmission delay required for data to be transmitted from the source node to the target node.

[0088] The packet loss rate can be the percentage of the number of packets lost during the transmission process within a unit time to the total number of packets sent.

[0089] The remaining bandwidth can be the available transmission bandwidth not occupied in the current network link.

[0090] The data sensitivity can be the data security level, which can be divided into three levels: high, medium and low.

[0091] The bandwidth preemption priority can be the network resource preemption level, which can be divided into four levels: emergency, high, medium, and low.

[0092] The best transmission protocol can be the optimal data transmission rule.

[0093] Specifically, based on the network topology information, the real-time latency, packet loss rate, and remaining bandwidth between network nodes are collected through distributed probes. Then, according to the information entropy theory and the multi-dimensional access control model, the meta-attributes of the currently newly added data and the real-time operation logs are analyzed, multi-dimensional feature vectors are extracted and input into the preset sensitivity classification rule library, and the data sensitivity is output through the rule inference engine. Subsequently, the analytic hierarchy process and the fuzzy comprehensive evaluation method are used to construct a dynamic weight model according to the weight ratio relationship between the data sensitivity and the data characteristics, so as to calculate and generate the bandwidth preemption priority. Furthermore, based on the bandwidth preemption priority and the data sensitivity, the protocol decision tree branch is triggered according to the real-time latency; then, the security policy corresponding to the data sensitivity is superimposed to generate the best transport protocol. Analyze the bandwidth preemption priority level, define the fragmentation control rules; then, bind the path selection strategy according to the transmission protocol type; subsequently, inject the exception handling mechanism to generate the best transmission protocol; finally, based on the bandwidth preemption priority and the best transmission protocol, execute the differential transmission strategy.

[0094] Through this solution, analyze the network topology information, determine the real-time latency, packet loss rate, and remaining bandwidth, quantify the current network transmission capacity and stability, eliminate the problems of static network resource allocation and transmission protocols, and avoid link resource waste or data latency caused by relying on preset rules. Analyze the currently newly added data, determine the data sensitivity, break through the limitations of relying on manual annotation or static rules, improve the accuracy of sensitivity determination by dynamically associating data attributes and operation characteristics, and prevent resource allocation imbalance. Determine the bandwidth preemption priority according to the data sensitivity and data characteristics, ensure that high-sensitive data preempts high-quality network resources first, avoid low-value data occupying high-priority links, and improve the timeliness of data backup. Determine the best transmission protocol according to the bandwidth preemption priority, data sensitivity, and real-time latency, which helps to eliminate the problem of the disconnection between protocol selection and network status. Determine the differential backup scheme for fragmented data according to the bandwidth preemption priority and the best transmission protocol, which helps to eliminate the problems of bandwidth waste and semantic relevance damage caused by fixed chunking.

[0095] In some embodiments, an emergency backup request is parsed to determine the data to be backed up; the process call chain of the data to be backed up is scanned to identify abnormal dynamic link libraries; the abnormal dynamic link libraries are extracted to determine isolated data blocks and the API call sequence of each isolated data block; based on the API call sequence, each isolated data block is matched with a known virus behavior feature library; according to the matching result, the abnormal data blocks with abnormal features are determined; the abnormal data blocks are transferred to an isolated storage pool for virus feature comparison, and according to the virus comparison result, it is determined whether the abnormal data blocks carry viruses.

[0096] The data to be backed up can be a data set that needs to be protected.

[0097] The process call chain can be a dynamic call relationship graph formed during the execution of different processes.

[0098] The abnormal dynamic link library can be a suspicious dynamic link library file.

[0099] The isolated data block can be a data segment separated from the data to be backed up and containing an abnormal dynamic link library or an abnormal API call sequence.

[0100] The API call sequence can be an ordered record of the API names, parameters, and call timings called by the dynamic link library during operation.

[0101] The known virus behavior feature library can be a database storing the static features and dynamic behavior patterns of known virus families.

[0102] The abnormal feature can be an indicator deviating from the normal behavior pattern.

[0103] The abnormal data block can be an isolated data block carrying a known virus variant or a suspicious unknown threat.

[0104] The isolated storage pool can be an encrypted storage area independent of the production environment.

[0105] The virus comparison result can be a determination conclusion generated through static feature matching, dynamic behavior analysis, and sandbox verification.

[0106] A virus can be a program code that achieves malicious purposes by tampering with data and hijacking processes.

[0107] Specifically, parse the trigger timestamp and data identifier in the emergency backup request, and extract the storage path and metadata index of the data to be backed up. Then, quickly locate the data to be backed up from the storage path according to the metadata index. Mount the device kernel debugging interface to capture the call chain topology diagram of the process associated with the data to be backed up. Traverse the dynamic link library loading records in the process call chain to identify abnormal dynamic link libraries. Perform memory mapping analysis on the abnormal dynamic link libraries to extract the API call sequence of each isolated data block: First, reverse-trace the physical address of the associated data block through the memory paging table. Second, establish a dynamic link library-data block mapping table to record the file path, memory start / end address, and last modification timestamp of each data block. Then, intercept the call records within the time window before and after the trigger time point. Finally, arrange the API operations involving the isolated data blocks in chronological order. Input the API call sequence into the known virus behavior feature library for multi-dimensional matching: First, compare the API call sequence with the malicious code fingerprints in the known virus behavior feature library. Then, calculate the cosine similarity between the API call sequence and the known virus behavior feature library. If the similarity is high, it is determined as a potential threat. Finally, output the matching result and mark the abnormal data blocks with abnormal features. Furthermore, transfer the abnormal data blocks to the isolation storage pool, start the sandbox environment to load the data blocks, and monitor the process creation and file modification behaviors of the abnormal data blocks. Then, inject dynamic taint tracking probes to record the memory read and write trajectories. Finally, compare the sandbox behavior logs with the attack chain patterns in the known virus feature library to determine whether the abnormal data blocks carry viruses.

[0108] Through this solution, parse the emergency backup request to determine the data to be backed up, ensure that the backup target range can be quickly locked in complex abnormal scenarios, and avoid response delays caused by manual retrieval. Scan the process call chain of the data to be backed up to identify abnormal dynamic link libraries, which helps filter legitimate processes hijacked by Rootkit viruses and eliminate missed detection problems caused by the lack of call chain tracking. Extract abnormal dynamic link libraries, determine the isolated data blocks and the API call sequence of each isolated data block, which helps break through the detection blind spot of unsigned viruses by static feature scanning. Based on the API call sequence, match each isolated data block with the known virus behavior feature library, which helps ensure the rapid identification of known virus variants and detect zero-day attacks through behavioral pattern similarity. According to the matching result, determine the abnormal data blocks with abnormal features to avoid mis-isolation of normal data caused by over-sensitivity. Transfer the abnormal data blocks to the isolation storage pool for virus feature comparison, and determine whether the abnormal data blocks carry viruses according to the virus comparison result, which helps capture hidden attack chains that cannot be discovered by static scanning.

[0109] In some embodiments, if an abnormal data block carries a virus, time rollback is performed on the abnormal data block to determine the pre-infection data; according to the virus comparison result, the infection degree of the abnormal data block is determined; according to the infection degree, the data sensitivity level of each abnormal data block is determined; according to the data sensitivity level, network topology information, and data characteristics, a differential backup scheme for fragment data is determined.

[0110] The pre-infection data can be a data version that has not been tampered with or contaminated.

[0111] The infection degree can be a quantitative evaluation index for the influence range of the virus in the abnormal data block.

[0112] The data sensitivity level can be the data security requirement level.

[0113] Specifically, based on the transaction logs or snapshot time points recorded in the version control library, the abnormal data block carrying the virus is rolled back to the last trusted version before infection, and the pre-infection data is extracted. Then, based on the statistical analysis of virus behavior characteristics and the quantitative model of hazard propagation rate, the dynamic operation sequence of malicious behavior is mapped to a behavior hazard index; subsequently, the infection range index and behavior hazard index in the virus comparison result are parsed, and combined with the preset infection threshold table established by clustering analysis to delimit different threat levels, the infection level of the abnormal data block is output. Subsequently, in combination with the infection degree and the sensitivity label of the original data, the grading weight is dynamically adjusted according to the rules, so as to determine the data sensitivity level of each abnormal data block. According to the sensitivity level weight, the data is divided into priority queues; then, in combination with the real-time link bandwidth and packet loss rate in the network topology information and data characteristics, a dedicated encryption channel is allocated for high-sensitivity data, and a compression transmission protocol is used for low-sensitivity data; furthermore, incremental block verification is enabled for high-frequency updated data, and only the differential blocks with mismatched hash values are transmitted; finally, a differential backup scheme for fragment data is determined.

[0114] Through this solution, if an abnormal data block carries a virus, time rollback is performed on the abnormal data block to determine the pre-infection data, avoiding the spread of the virus to remote nodes through the backup link and eliminating the risk of secondary infection caused by the conflict between virus intrusion and the backup process without isolation. According to the virus comparison result, the infection degree of the abnormal data block is determined, avoiding mis-killing or missed detection caused by inaccurate positioning of the abnormal data block. According to the infection degree, the data sensitivity level of each abnormal data block is determined, which helps to eliminate the resource mismatch problem caused by the static nature of sensitivity assessment. According to the data sensitivity level, network topology information, and data characteristics, a differential backup scheme for fragment data is determined, which helps to eliminate the data delay problem caused by the static defect of network resource allocation, reduce the amount of redundant data transmission, and alleviate the bandwidth waste caused by insufficient adaptation of data disassembling granularity.

[0115] In some embodiments, environmental monitoring data and intrusion monitoring data are obtained in real time; the environmental monitoring data and the intrusion monitoring data are analyzed to determine environmental changes and port access situations; the port access situations are analyzed to determine whether there are abnormal accesses; if it is determined that there are abnormal accesses, the number of abnormal accesses is determined according to the port access situations; the number of abnormal accesses is compared with an abnormal access frequency threshold; the environmental changes are analyzed to determine whether any two environmental parameters exceed their corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed their corresponding critical values, an emergency backup request is generated; the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed their corresponding critical values, is determined as the trigger time point.

[0116] The environmental monitoring data can be real-time physical environmental parameter values.

[0117] The intrusion monitoring data can be network behavior records captured by network security devices.

[0118] Environmental changes can be states where environmental parameters are determined to exceed the normal fluctuation range.

[0119] The port access situation can be the statistical access behavior of the server ports in different time periods.

[0120] Abnormal access can be port access behavior that does not conform to the preset whitelist rules or has attack characteristics.

[0121] The number of abnormal accesses can be the cumulative number of abnormal port access events counted within a unit time window.

[0122] The abnormal access frequency threshold can be the critical value of the number of abnormal accesses dynamically set according to the business scenario.

[0123] Environmental parameters can be quantitative indicators used to describe the state of the physical environment.

[0124] The corresponding critical value can be the security threshold preset for each environmental parameter.

[0125] Specifically, environmental monitoring data is obtained in real time through sensor readings such as temperature, humidity, and voltage fluctuations deployed on monitoring nodes; at the same time, intrusion monitoring data is captured synchronously through port access records and traffic characteristics. Analyze the environmental monitoring data stream, extract the real-time values of temperature and humidity, perform time series analysis on the real-time values of temperature and humidity, and mark environmental changes; then, perform access behavior clustering on the intrusion monitoring data to identify abnormal port access situations. Furthermore, count the number of accesses by the same source IP to abnormal port access situations per unit time, and determine whether there is abnormal access. If the number of accesses exceeds the total number of normal business port accesses, it is determined that there is abnormal access; subsequently, count the cumulative number of abnormal accesses within consecutive time units to generate the number of abnormal accesses. Set the abnormal access frequency threshold according to the average number of accesses in the same historical time period; compare the number of abnormal accesses within the current time window with the preset abnormal access frequency threshold. Traverse the environmental changes to check whether any two environmental parameters exceed the corresponding critical values. Count the abnormal port access events. If the number of abnormal accesses per unit time exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values, then package the trigger type, list of exceeded parameters, or list of abnormal access IPs, and the trigger time point into a structured request message, thereby generating an emergency backup request. Furthermore, perform retrospective verification on the time points that meet the conditions of the number of abnormal accesses exceeding the abnormal access frequency threshold or any two environmental parameters exceeding the corresponding critical values, and eliminate instantaneous jitter interference; finally, use the starting time of the first continuous overlimit as the backup trigger time point.

[0126] Through this solution, environmental monitoring data and intrusion monitoring data are obtained in real time, eliminating the triggering delay caused by a single data source and providing multi-source input for composite anomaly determination. Analyze the environmental monitoring data and intrusion monitoring data to determine environmental changes and port access conditions, avoiding potential risks of misjudgment by a single indicator. Analyze the port access conditions to determine whether there is abnormal access, which helps to eliminate the problem of unrecognized stealth scans. If abnormal access is determined, then according to the port access conditions, determine the number of abnormal accesses, quantify the intensity of the attack behavior, and provide a dynamic statistical basis for threshold comparison, replacing the false alarms caused by fixed-period sampling. Compare the number of abnormal accesses with the abnormal access frequency threshold to avoid false triggers caused by traffic tidal phenomena, and at the same time ensure that high-frequency attacks can trigger backups in a timely manner. Analyze environmental changes to determine whether any two environmental parameters exceed the corresponding critical values, which helps to identify false alarms caused by single sensor failures or local environmental fluctuations and improve the accuracy of composite disaster determination. If the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values, then generate an emergency backup request to ensure that any high-risk event can trigger a backup independently. Determine the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values as the trigger time point, avoiding data contamination during recovery caused by the time ambiguity of full backups.

[0127] In some embodiments, according to the data characteristics, determine the metadata attributes of the currently newly added data; obtain historical operation data, extract the historical operation data, and determine the identity identifier of the data creator, the data access control list, and the data encryption status; according to the identity identifier of the data creator, query the preset organizational structure database to determine the security level of the business department to which the data belongs; analyze the data access control list to identify the authorized user roles and the scope of permission operations; calculate the data sensitivity through a weighted decision tree model according to the security level, the scope of permission operations, and the encryption status.

[0128] The metadata attributes can be descriptive information of the data itself.

[0129] The historical operation data can be the operation audit log records for a past period related to the data. This past period can be taken according to experience or specified manually.

[0130] The identity identifier of the data creator can be the user account identifier that generates or first writes the data.

[0131] The data access control list can be a list of data access permissions.

[0132] The data encryption status can be a flag indicating whether the data has been encrypted.

[0133] The preset organizational structure database can be a database that stores the mapping relationship between accounts and their affiliated business departments in advance. It is stored in the server in advance and called when needed.

[0134] The business department to which the data belongs can be the organizational department to which the data creator belongs.

[0135] The security level can be a level value set based on the security policy of the business department.

[0136] The authorized user role can be the classification of user identities defined in the data access control list.

[0137] The scope of permission operations can be the set of specific operations that authorized users are allowed to perform in the data access control list.

[0138] The weighted decision tree model can be the calculation logic used to fuse multi-dimensional parameters and output sensitivity values.

[0139] Specifically, according to the data characteristics, extract metadata attributes from the file header, database table structure, or log record of the currently newly added data. Call the operation audit log interface to retrieve the historical operation records associated with the currently newly added data. Thus, extract the creator account recorded in the historical operation log and read the authorized user list and user operation permissions from the database permission configuration, synchronously parse the file metadata database attributes, and determine whether the data is encrypted. Furthermore, based on the enterprise organizational hierarchy model and the principle of separation of duties, map the preset organizational structure database through the department tree structure; according to the identity identifier of the data creator, query the preset organizational structure database to obtain the affiliated business department; then, based on the department security policy configuration file, match the security level corresponding to the affiliated business department. Subsequently, parse the syntax structure of the data access control list to identify the authorized user role; then, follow the principle of least privilege and orthogonally map the role and operation permissions according to the access control matrix model to preset the role permission table; according to the preset role permission table, map the role to the scope of permission operations. Convert the security level to a weight base number, convert the scope of permission operations to a permission strength coefficient by bitmask value, and convert the encryption status to a boolean value. Subsequently, input the weight base number, permission strength coefficient, and boolean value into the weighted decision tree model to execute the decision tree calculation logic, thereby outputting the normalized data sensitivity.

[0140] Through this solution, according to the data characteristics, the metadata attributes of the currently newly added data are determined, providing a classification basis for data sensitivity analysis and avoiding evaluation biases caused by data type confusion. Obtaining historical operation data, extracting historical operation data, and determining the identity identifier of the data creator, the data access control list, and the data encryption status help eliminate the static problem of relying on manual annotation. According to the identity identifier of the data creator, query the preset organizational structure database to determine the security level of the business department to which the data belongs, and realize the real-time linkage between sensitivity evaluation and organizational security policies. Analyze the data access control list, identify the authorized user roles and the scope of permission operations, quantify the data access control intensity, identify potential over-authorization risks, and avoid misjudgment of sensitivity caused by simple rules. Calculate the data sensitivity through a weighted decision tree model based on the security level, the scope of permission operations, and the encryption status, which helps eliminate the defect of one-sidedly relying on a single dimension.

[0141] Figure 3 The following is a schematic structural diagram of a data preservation application system for a server provided by an embodiment of the present application, as Figure 3 shown, the data preservation application system 300 for a server in this embodiment includes: a request parsing module 301, a data determination module 302, a data disassembling module 303, and a solution determination module 304.

[0142] The request parsing module 301 is configured to obtain an emergency backup request, parse the emergency backup request, and determine the trigger time point; The data determination module 302 is configured to retrieve historical backup data according to the trigger time point, and determine the currently newly added data according to the historical backup data; The data disassembling module 303 is configured to parse the currently newly added data to obtain data characteristics; according to the data characteristics, perform multi-dimensional disassembling on the currently newly added data to obtain segment data; The solution determination module 304 is configured to obtain the network topology information at the current moment, and determine a differential backup solution for the segment data according to the network topology information and the data characteristics to perform data preservation operations.

[0143] Optionally, when the data disassembling module 303 parses the currently newly added data to obtain data characteristics, it is configured to: use the binary mode to extract the file header bytes of the currently newly added data to determine the file type; match the extracted bytes with a predefined signature database, and determine the file format signature according to the matching result; obtain the data storage path of the currently newly added data, and determine the data extension according to the data storage path; calculate the occurrence frequency of bytes in each currently newly added data; determine the content entropy value according to the occurrence frequency; obtain the database transaction log; determine the access frequency of the currently newly added data according to the database transaction log; and determine the file type, the file format signature, the data extension, the content entropy value, and the access frequency as the data characteristics of the currently newly added data.

[0144] Optionally, when the data disassembling module 303 disassembles the currently newly added data in multiple dimensions according to the data characteristics to obtain fragmented data, it is used for: determining structured data, unstructured data, and time-series data according to the data characteristics; analyzing the structured data, unstructured data, and time-series data to determine the corresponding chunking algorithms; analyzing the database transaction log to determine the log writing frequency and the written data; determining the disassembly granularity according to the log writing frequency and the written data; disassembling the currently newly added data in multiple dimensions according to the chunking algorithms and the disassembly granularity to obtain fragmented data.

[0145] Optionally, when the data disassembling module 303 determines the disassembly granularity according to the log writing frequency and the written data, it is used for: parsing the written data to determine the size of the written data block and the type of the written data; determining the frequently written data and the infrequently written data according to the type of the written data; determining the high-frequency update frequency of the frequently written data and the low-frequency update frequency of the infrequently written data according to the log writing frequency; determining the disassembly granularity according to the size of the written data block, the high-frequency update frequency, and the low-frequency update frequency.

[0146] Optionally, when the solution determining module 304 determines the differential backup solution for the fragmented data according to the network topology information and the data characteristics, it is used for: analyzing the network topology information to determine the real-time delay, the packet loss rate, and the remaining bandwidth; analyzing the currently newly added data to determine the data sensitivity; determining the bandwidth preemption priority according to the data sensitivity and the data characteristics; determining the optimal transmission protocol according to the bandwidth preemption priority, the data sensitivity, and the real-time delay; determining the differential backup solution for the fragmented data according to the bandwidth preemption priority and the optimal transmission protocol.

[0147] Optionally, the data preservation application system for the server further includes a virus determination module 305, which is used for: parsing the emergency backup request to determine the data to be backed up; scanning the process call chain of the data to be backed up to identify abnormal dynamic link libraries; extracting the abnormal dynamic link libraries to determine the isolated data blocks and the API call sequence of each isolated data block; matching each isolated data block with the known virus behavior feature library based on the API call sequence; determining the abnormal data blocks with abnormal features according to the matching result; transferring the abnormal data blocks to the isolation storage pool for virus feature comparison, and determining whether the abnormal data blocks carry viruses according to the virus comparison result.

[0148] Optionally, when determining the differential backup solution for the fragment data according to the network topology information and data characteristics, the solution determination module 304 is configured to: if the abnormal data block carries a virus, roll back the time of the abnormal data block to determine the data before infection; determine the infection degree of the abnormal data block according to the virus comparison result; determine the data sensitivity level of each abnormal data block according to the infection degree; and determine the differential backup solution for the fragment data according to the data sensitivity level, network topology information, and data characteristics.

[0149] Optionally, when the request parsing module 301 obtains an emergency backup request, parses the emergency backup request, and determines the trigger time point, it is configured to: obtain environmental monitoring data and intrusion monitoring data in real time; analyze the environmental monitoring data and intrusion monitoring data to determine environmental changes and port access conditions; analyze the port access conditions to determine whether there is abnormal access; if it is determined that there is abnormal access, determine the number of abnormal accesses according to the port access conditions; compare the number of abnormal accesses with the abnormal access frequency threshold; analyze the environmental changes to determine whether any two environmental parameters exceed the corresponding critical values; if the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values, generate an emergency backup request; and determine the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values as the trigger time point.

[0150] Optionally, when analyzing the currently newly added data and determining the data sensitivity, the solution determination module 304 is configured to: determine the metadata attributes of the currently newly added data according to the data characteristics; obtain historical operation data, extract the historical operation data, and determine the identity identifier of the data creator, the data access control list, and the data encryption status; query the preset organizational structure database according to the identity identifier of the data creator to determine the security level of the business department to which the data belongs; analyze the data access control list to identify the authorized user roles and permission operation scopes; and calculate the data sensitivity through a weighted decision tree model according to the security level, permission operation scope, and encryption status.

[0151] The system of this embodiment can be used to execute the method of any of the above embodiments, and its implementation principle and technical effects are similar, which will not be elaborated here.

Claims

1. A data preservation method for a server, characterized in that, Including: Obtain an emergency backup request, parse the emergency backup request, and determine the trigger time point; According to the trigger time point, retrieve historical backup data, and according to the historical backup data, determine the current newly added data; Parse the current newly added data to obtain data characteristics; according to the data characteristics, perform multi-dimensional decomposition on the current newly added data to obtain segment data; Obtain the network topology information at the current moment, and according to the network topology information and the data characteristics, determine a differential backup plan for the segment data to perform data preservation operations.

2. The method according to claim 1, wherein The parsing of the current newly added data to obtain data characteristics includes: Using the binary mode, extract the file header bytes of the current newly added data to determine the file type; Match the extracted bytes with a predefined signature database, and according to the matching result, determine the file format signature; Obtain the data storage path of the current newly added data, and according to the data storage path, determine the data extension; Calculate the occurrence frequency of bytes in each current newly added data; according to the occurrence frequency, determine the content entropy value; Obtain the database transaction log; according to the database transaction log, determine the access frequency of the current newly added data; Determine the file type, the file format signature, the data extension, the content entropy value, and the access frequency as the data characteristics of the current newly added data.

3. The method according to claim 2, wherein The multi-dimensional decomposition of the current newly added data according to the data characteristics to obtain segment data includes: According to the data characteristics, determine structured data, unstructured data, and time-series data; Analyze the structured data, the unstructured data, and the time-series data to determine the corresponding chunking algorithms; Analyze the database transaction log to determine the log write frequency and the written data; According to the log write frequency and the written data, determine the decomposition granularity; According to the chunking algorithms and the decomposition granularity, perform multi-dimensional decomposition on the current newly added data to obtain segment data.

4. The method according to claim 3, characterized in that, The determining of the decomposition granularity according to the log write frequency and the written data includes: Parse the written data to determine the written data block size and the written data type; According to the written data type, determine the high-frequency written data and the low-frequency written data; According to the log write frequency, determine the high-frequency update frequency of the high-frequency written data and the low-frequency update frequency of the low-frequency written data; According to the written data block size, the high-frequency update frequency, and the low-frequency update frequency, determine the decomposition granularity.

5. The method according to claim 1, characterized in that, The determining of the differential backup plan for the segment data according to the network topology information and the data characteristics includes: Analyze the network topology information to determine the real-time delay, the packet loss rate, and the remaining bandwidth; Analyze the current newly added data to determine the data sensitivity; According to the data sensitivity and the data characteristics, determine the bandwidth preemption priority; According to the bandwidth preemption priority, the data sensitivity, and the real-time delay, determine the best transmission protocol; According to the bandwidth preemption priority and the best transmission protocol, determine the differential backup plan for the segment data.

6. The method according to claim 1, wherein After parsing the emergency backup request and determining the trigger time point, the following steps are also included: Parse the emergency backup request to determine the data to be backed up; Scan the process call chain of the data to be backed up to identify abnormal dynamic link libraries; Extract the abnormal dynamic link libraries to determine the isolated data blocks and the API call sequence of each isolated data block; Based on the API call sequence, match each isolated data block with a known virus behavior feature library; According to the matching result, determine the abnormal data blocks with abnormal features; Transfer the abnormal data blocks to an isolation storage pool for virus feature comparison, and according to the virus comparison result, determine whether the abnormal data blocks carry viruses.

7. The method according to claim 6, wherein The step of determining the differential backup plan for the fragment data according to the network topology information and the data characteristics includes: If the abnormal data block carries a virus, perform a time rollback on the abnormal data block to determine the data before infection; According to the virus comparison result, determine the infection degree of the abnormal data block; According to the infection degree, determine the data sensitivity level of each abnormal data block; According to the data sensitivity level, the network topology information and the data characteristics, determine the differential backup plan for the fragment data.

8. The method according to claim 1, characterized in that The step of obtaining an emergency backup request, parsing the emergency backup request, and determining the trigger time point includes: Real-time obtain environmental monitoring data and intrusion monitoring data; Analyze the environmental monitoring data and the intrusion monitoring data to determine environmental changes and port access conditions; Analyze the port access conditions to determine whether there is abnormal access; If it is determined that there is abnormal access, determine the number of abnormal accesses according to the port access conditions; Compare the number of abnormal accesses with an abnormal access frequency threshold; Analyze the environmental changes to determine whether any two environmental parameters exceed the corresponding critical values; If the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values, generate an emergency backup request; Determine the time when the number of abnormal accesses exceeds the abnormal access frequency threshold, or any two environmental parameters exceed the corresponding critical values as the trigger time point.

9. The method according to claim 5, wherein The step of analyzing the currently newly added data and determining the data sensitivity includes: According to the data characteristics, determine the metadata attributes of the currently newly added data; Obtain historical operation data, extract the historical operation data, and determine the identity identifier of the data creator, the data access control list, and the data encryption status; According to the identity identifier of the data creator, query a preset organizational structure database to determine the security level of the business department to which the data belongs; Analyze the data access control list to identify the authorized user roles and the scope of permission operations; According to the security level, the scope of permission operations, and the encryption status, calculate the data sensitivity through a weighted decision tree model.

10. A data preservation application system for a server, characterized in that, Applied to the method according to any one of claims 1-9, it includes: A request parsing module for obtaining an emergency backup request, parsing the emergency backup request, and determining the trigger time point; A data determination module, configured to retrieve historical backup data according to the trigger time point, and determine current newly added data according to the historical backup data; A data disassembling module, configured to analyze the current newly added data to obtain data features; and disassemble the current newly added data in multiple dimensions according to the data features to obtain fragmented data; A solution determination module, configured to obtain network topology information at the current moment, and determine a differential backup solution for the fragmented data according to the network topology information and the data features to perform a data preservation operation.

Images